Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Thelia 3.1.2, 3.2.1 Clear all filters
TI-2026-71032 CVE-2026-109397 · GHSA-hjxm-gpw4-w4q7

Unrestricted file upload in Thelia allows PHP code execution

Priority MEDIUM 40

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00441 Published 2026-10-12 Fixed in 3.1.2, 3.2.1 CWE-434
TI-2026-71031 CVE-2026-109396 · GHSA-w4v5-q3gm-mcf9

CSV formula injection in Thelia exports lets visitors run spreadsheet formulas

Priority MEDIUM 45

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fiel…

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00232 Published 2026-10-12 Fixed in 3.1.2, 3.2.1 CWE-1236